1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-28762: recursive call of some json functions without stack control

Browse Source 
Analysis: Some recursive json functions dont check for stack control
Fix: Add check_stack_overrun(). The last argument is NULL because it is not
used
This commit is contained in:
Rucha Deodhar 2022-06-22 14:37:52 +05:30
parent 3a9cb4c1d7
commit 0ea221e12b
3 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
mysql-test/main/json_debug_nonembedded.result Normal file
View File

@ -0,0 +1,13 @@
#
# Beginning of 10.6 test
#
# MDEV-28762: recursive call of some json functions without stack control
#
SET @saved_debug= @@debug_dbug;
SET @@debug_dbug='+d,json_check_min_stack_requirement';
SELECT * from JSON_TABLE('[{"a": 1, "b": [11,111]}, {"a": 2, "b": [22,222]}]', '$[*]' COLUMNS( a INT PATH '$.a')) as tt;
ERROR HY000: Thread stack overrun: 'used bytes' used of a 'available' byte stack, and 'X' bytes needed. Consider increasing the thread_stack system variable.
SET @@debug_dbug= @saved_debug;
#
# End of 10.6 tests
#

22
mysql-test/main/json_debug_nonembedded.test Normal file
View File

@ -0,0 +1,22 @@
-- source include/not_embedded.inc
--source include/have_debug.inc
--echo #
--echo # Beginning of 10.6 test
--echo #
--echo # MDEV-28762: recursive call of some json functions without stack control
--echo #
SET @saved_debug= @@debug_dbug;
SET @@debug_dbug='+d,json_check_min_stack_requirement';
--replace_regex /overrun: [0-9]* bytes used of a [0-9]* byte stack, and [0-9]* bytes needed/overrun: 'used bytes' used of a 'available' byte stack, and 'X' bytes needed/
--error ER_STACK_OVERRUN_NEED_MORE
SELECT * from JSON_TABLE('[{"a": 1, "b": [11,111]}, {"a": 2, "b": [22,222]}]', '$[*]' COLUMNS( a INT PATH '$.a')) as tt;
SET @@debug_dbug= @saved_debug;
--echo #
--echo # End of 10.6 tests
--echo #

15
sql/json_table.cc
View File

@ -25,6 +25,7 @@
#include "sql_show.h"
#include "sql_select.h"
#include "create_tmp_table.h"
#include "sql_parse.h"
#define HA_ERR_JSON_TABLE (HA_ERR_LAST+1)
@ -101,6 +102,10 @@ int get_disallowed_table_deps_for_list(MEM_ROOT *mem_root,
NESTED_JOIN *nested_join;
List_iterator<TABLE_LIST> li(*join_list);
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
{alloca(my_thread_stack_size-(STACK_MIN_SIZE));});
if (check_stack_overrun(current_thd, STACK_MIN_SIZE, NULL))
return 1;
while ((table= li++))
{
if ((nested_join= table->nested_join))
@ -1304,6 +1309,11 @@ static void add_extra_deps(List<TABLE_LIST> *join_list, table_map deps)
{
TABLE_LIST *table;
List_iterator<TABLE_LIST> li(*join_list);
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
{alloca(my_thread_stack_size-(STACK_MIN_SIZE));});
if (check_stack_overrun(current_thd, STACK_MIN_SIZE, NULL))
return;
while ((table= li++))
{
table->dep_tables |= deps;
@ -1392,6 +1402,11 @@ table_map add_table_function_dependencies(List<TABLE_LIST> *join_list,
table_map res= 0;
List_iterator<TABLE_LIST> li(*join_list);
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
{alloca(my_thread_stack_size-(STACK_MIN_SIZE));});
if ((res= check_stack_overrun(current_thd, STACK_MIN_SIZE, NULL)))
return res;
// Recursively compute extra dependencies
while ((table= li++))
{